Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 18:46
Behavioral task
behavioral1
Sample
2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260804-xe1dlavyct
- SHA256 95c93efc5e68eb56041668cc112494786a0410e4c2c3d37d910e0c2cf201941c
- MD5 aed41aee2fd6824fa9f0e034d7277ea0
- SHA1 99a1ca0862d93e233b77dd22eb0f3d617acd1c9a
- SHA512 fab04b45bd7743126c4cfc0a6d9030fbf33689243879dd6a69d0726c4ae8e052db0dce3969d3f8a5af9c09578dcaaa17642c34e0ec9cad52bd69cc2698a10aa3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UNJj1YTqMi8CtBd2QHCHmTBW5:A3k03kB56ruqJtb2I
- TLSH T140654A16F6A44B65D06BC074C5D29666EA333C425F3087CB1349AE283F37BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/2448-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244e7-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3056-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000016909-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2448-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3056-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0016000000016909-150.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216ae-745.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b0000000006d1-2064.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244e7-5.dat aspack_v212_v242 behavioral1/files/0x0003000000016909-12.dat aspack_v212_v242 behavioral1/files/0x0016000000016909-150.dat aspack_v212_v242 behavioral1/files/0x00030000000216ae-745.dat aspack_v212_v242 behavioral1/files/0x000b0000000006d1-2064.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3056 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe$ 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2448 2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3056 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_aed41aee2fd6824fa9f0e034d7277ea0_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2448
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 95c93efc5e68eb56041668cc112494786a0410e4c2c3d37d910e0c2cf201941c
- MD5 aed41aee2fd6824fa9f0e034d7277ea0
- SHA1 99a1ca0862d93e233b77dd22eb0f3d617acd1c9a
- SHA512 fab04b45bd7743126c4cfc0a6d9030fbf33689243879dd6a69d0726c4ae8e052db0dce3969d3f8a5af9c09578dcaaa17642c34e0ec9cad52bd69cc2698a10aa3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UNJj1YTqMi8CtBd2QHCHmTBW5:A3k03kB56ruqJtb2I
- TLSH T140654A16F6A44B65D06BC074C5D29666EA333C425F3087CB1349AE283F37BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 90d2f6d9a2af61d0f47c8f7939e47a7b3e5c313ec3272e8fa4e73fddac2f81da
- MD5 af4f20e7847e4e1f396913df077261da
- SHA1 76e620f28565f36993715dcac02f84d42509dde7
- SHA512 280b5c45da665d59a93a7e76c69ef77a525c7a725e91b56385b173eed1d487727e66e676f498e79992a265a3f4260c6ebe81773c3cc6bd4698a15cb1dec9d04e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UNJj1YTqMi8CtBd2QHCHmTBW5XD:A3k03kB56ruqJtb2IQPji0Aj
- TLSH T1F1A54A16F6A44B65D07BC0B9C5D2969AEA323C425F308BCB1345DB283F277D1963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$
- Size 1.6MB
- SHA256 cd1898d14c59a9b8cc0ad7335fe4ac4ca0468329c14a7855b933da13b14e816b
- MD5 8b6aa6a5b8bebc3209285ce953820b97
- SHA1 ab6c84b8588e1f9d8e9cbf4cef09c54bfceb3dd3
- SHA512 0018952b28764e15cec6179974896c105494dc3c75a7196d73a77b708ca2cb158fcbd70d2ec4872580589eb68d290ea19f9514817320226e1861409b8c8f980b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UNJj1YTqMi8CtBd2QHCHmTBW5sD:A3k03kB56ruqJtb2It
- TLSH T125751816E6644B65D06FC074C7929656FA333C425FA087CB13C5EA3C3F226D19ABA363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 2.0MB
- SHA256 43eb9c9e2e91752b2dc4b054111b0c1cd673aeee2a3922b304c9a5ff40a61f82
- MD5 96aa1371c9224b682885412766c5a031
- SHA1 2a5d2130cf30381e2751c9fd18c1e61cf6cdc6b2
- SHA512 f5ba39c3497cfbcc2f2bc27b8c4cda7f86eff664f1f25bf2be4db9e55ceb70f04e19fcc5cefd920857b33bb9b5682f3be708e40a6f9de1a35d844f8e24e6e4e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UNJj1YTqMi8CtBd2QHCHmTBW5/X:A3k03kB56ruqJtb2I8UOlk09
- TLSH T16E955C26E6644BA1D07BC178C6D29656EA733C414F3087CB5359DA293F337D09E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 1.7MB
- SHA256 62927a0df22663cc7d8c13939d3c22436bc2eab7b9797bda1b5c4826c3d0a074
- MD5 bace2ee1f423d894cb72eaff428bac3a
- SHA1 ea66202e9689a5d72f2db3584d2643885ca6dabf
- SHA512 5d49c24332f9a5845e8cc592b8902ff19e95d1ee5f4591668c307ec814c483564bdda5fa0e5aac8f3a70a9bb3523a7a8211f2bdb15fb009c596336a7432722b1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UNJj1YTqMi8CtBd2QHCHmTBW5zA:A3k03kB56ruqJtb2Iai2WH3
- TLSH T198856C22F6A44B75D02BC075C5D6966AEA333C425F3087CB1345AA293F737D19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH